Overview

overview

10

Static

static

10

0fe222f25a...62.exe

windows7_x64

10

0fe222f25a...62.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fe222f25a5243df9dec4a79a7a0fe1c0a8968080961fb87ffae617770614b62

  • Size

    217KB

  • Sample

    220212-g8xxkaafcq

  • MD5

    9315dc11c81030e9fa1aee1eba710666

  • SHA1

    8d42eb329f1d8c96d5e9de2fc856ac94a79a05a2

  • SHA256

    0fe222f25a5243df9dec4a79a7a0fe1c0a8968080961fb87ffae617770614b62

  • SHA512

    484e5e3c68b1ed9b6d89f700c517f5f0823410d2f8aade77488285b4eaf72f3a6a69adeb154a182351d0f085cafff4706ba990aa2f72f87518efcfb6dde7a158

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0fe222f25a5243df9dec4a79a7a0fe1c0a8968080961fb87ffae617770614b62

    • Size

      217KB

    • MD5

      9315dc11c81030e9fa1aee1eba710666

    • SHA1

      8d42eb329f1d8c96d5e9de2fc856ac94a79a05a2

    • SHA256

      0fe222f25a5243df9dec4a79a7a0fe1c0a8968080961fb87ffae617770614b62

    • SHA512

      484e5e3c68b1ed9b6d89f700c517f5f0823410d2f8aade77488285b4eaf72f3a6a69adeb154a182351d0f085cafff4706ba990aa2f72f87518efcfb6dde7a158

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks